CVE-2026-71192 OpenStack CVE debrief

Who should care

OpenStack Swift administrators and users with s3_acl=true configurations should review their bucket permissions and access controls. Additionally, security teams and vulnerability management teams should be aware of the potential for unauthorized data access and take steps to monitor and mitigate the vulnerability. Operators of OpenStack Swift deployments should also verify their configurations and implement compensating controls as needed.

Technical summary

OpenStack Swift through 2.38.0 has a vulnerability in the S3API middleware that allows an attacker to inject Swift-native control headers into a signed PUT request, potentially bypassing source object authorization and allowing access to private objects. This occurs when the s3_acl=true configuration is used, which is non-default. The vulnerability requires knowledge of the project_id, container name, and object name of the target object, but not its ACLs or ownership.

Defensive priority

Medium-priority defensive review recommended due to potential for unauthorized data access.

Recommended defensive actions

• Review OpenStack Swift configurations for s3_acl=true
• Verify bucket permissions and access controls
• Monitor for suspicious S3 API requests
• Implement compensating controls for object access
• Conduct a thorough review of affected systems and assets
• Track exceptions and retest remediated assets
• Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The evidence for this vulnerability is limited, primarily based on official records from CVE.org and NVD. The CVE record indicates a vulnerability in OpenStack Swift through 2.38.0, allowing unauthorized object access via S3API middleware. However, detailed technical analysis and additional sources are needed to fully understand the vulnerability's impact and affected configurations. Defenders should verify their OpenStack Swift configurations, especially those with s3_acl=true, and review bucket permissions and access controls.

Official resources